specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Sigstore
providerId: sigstore
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Code Signing
  - PKI
  - Security
  - Open Source
  - Rate Limiting
description: Sigstore's public-good Fulcio and Rekor instances do not publish formal per-client rate
  limits in the documentation overview; the project notes the service is operated as a public good and
  asks heavy consumers to self-host or run a private instance to protect shared capacity. Specific
  thresholds are not published as a developer-facing SLA.
sources:
  - https://docs.sigstore.dev/
notes: No formal rate-limit specification published. Heavy consumers are encouraged to self-host
  rather than rely on a published per-client rate ceiling.
limits:
  - name: Public-good fair use
    scope: client
    metric: varies
    limit: not publicly documented
    notes: Public Fulcio and Rekor instances are operated as a public good; heavy users are encouraged
      to self-host rather than rely on a published throttle.
policies:
  - name: Public-Good Fair Use
    description: Treat the public Sigstore instances as a shared public good. For high-volume signing
      or verification, self-host Fulcio/Rekor (or use a vendor-operated dedicated instance) rather
      than relying on the public service.
  - name: Self-Hosting for Scale
    description: Sigstore is open source; production-critical workloads should run their own Fulcio
      and Rekor to control availability and avoid dependence on shared infrastructure.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com